feat: added check logic and metadata

prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_scans_packages_vulnerabilities",
+  "CheckTitle": "Check if repositories scan packages for vulnerabilities",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "github:user-id:repository/repository-name",
+  "Severity": "high",
+  "ResourceType": "Other",
+  "Description": "Ensure that repositories scan packages for vulnerabilities to detect and remediate open-source vulnerabilities.",
+  "Risk": "Open-source vulnerabilities may exist in or be discovered for the packages an organization uses. These vulnerabilities can be exploited by attackers, potentially compromising the security of applications. Without proper monitoring, vulnerabilities affecting dependencies may go unnoticed, increasing the risk of breaches or failures in production environments.",
+  "RelatedUrl": "https://docs.github.com/en/code-security/dependabot/working-with-dependabot",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Implement and enforce tools to detect, monitor, and remediate open-source vulnerabilities. Enable GitHub's Dependabot alerts to track known issues, and consider integrating additional solutions to ensure comprehensive identification of vulnerabilities. This proactive approach mitigates security risks and helps maintain application stability and integrity.",
+      "Url": "https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.py

@@ -0,0 +1,37 @@
+from typing import List
+
+from prowler.lib.check.models import Check, Check_Report_Github
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_scans_packages_vulnerabilities(Check):
+    """Check if a repository scans packages for vulnerabilities
+
+    This class verifies whether each public repository scans packages for vulnerabilities.
+    """
+
+    def execute(self) -> List[Check_Report_Github]:
+        """Execute the Github Repository Scans Packages Vulnerabilities check
+
+        Iterates over all repositories and checks if they scan packages for vulnerabilities.
+
+        Returns:
+            List[Check_Report_Github]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            report = Check_Report_Github(self.metadata())
+            report.resource_id = repo.id
+            report.resource_name = repo.name
+            report.status = "FAIL"
+            report.status_extended = f"Repository {repo.name} does not scan vulnerabilities in used packages."
+
+            if repo.dependabot_enabled:
+                report.status = "PASS"
+                report.status_extended = f"Repository {repo.name} does scan vulnerabilities in used packages."
+
+            findings.append(report)
+
+        return findings

prowler/providers/github/services/repository/repository_service.py

@@ -35,6 +35,17 @@ class Repository(GithubService):
                             else False
                         )
 
+                        dependabot_status = False
+                        try:
+                            dependabot_status = (
+                                repo.security_and_analysis.dependabot_security_updates.status
+                                == "enabled"
+                            )
+                        except Exception as e:
+                            logger.warning(
+                                f"Could not determine dependabot status for repo {repo.name}: {e}"
+                            )
+
                         branch_protection = None
                         try:
                             branch = repo.get_branch(default_branch)
@@ -89,6 +100,7 @@ class Repository(GithubService):
                             securitymd=securitymd_exists,
                             default_branch_protection=branch_protection,
                             delete_branch_on_merge=delete_branch_on_merge,
+                            dependabot_enabled=dependabot_status,
                         )
 
         except Exception as error:
@@ -122,3 +134,4 @@ class Repo(BaseModel):
     default_branch_protection: Optional[Protection]
     securitymd: bool = False
     delete_branch_on_merge: bool = False
+    dependabot_enabled: bool = False